Re: dangerous handling of security bugs
| From: | sean finney | Date: | Mon, 12 Jul 2010 16:47:15 +0000 |
| Subject: | Re: dangerous handling of security bugs | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-49037@lists.php.net to get a copy of this message | ||
On Mon, Jul 12, 2010 at 03:50:19PM +0200, Reindl Harald wrote:
> It would be really relaxter if there are easy patches
> available which i could use in rpm-spec-file in a way
> like the following - the orinial source-tarball is
> unchanged and rpmbuild applys the patches diectly before
> build
while a bit tedious and sometimes error-prone, it's already possible to
find your way from the CVE to the relevant commits in svn.php.net. this
is how the distros usually get the fixes.
alternatively, if you're too lazy you can just wait for these distros
to do the work for you and take the patch from them. in debian for example
it is particularly easy to mooch patches from arbitrary packages, for
example: http://patch-tracker.debian.org/package/php5
sean
--